Skip to content

[LTS 8.8 RT] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 27, 2025

Conversation

pvts-mat
Copy link
Contributor

CVE-2022-42896
VULN-207

Solution

The bug fix in the mainline is provided1 in two commits:

  • f937b758a188d6fd328a81367087eddbb2fce50f
  • 711f8c3fb3db61897080468586b970c87c61d9e4

Of these the 711f8c3 is already applied on ciqlts8_8-rt (commit 698b38781fe5e12c9a62104a6e4d2d09d1b49b68).

(Same situation as in #41)

Build

Kernel built on virtual machine instantiated on physical Rocky 9 machine with

./ninja.sh _run_build-ciqlts8_8

from the https://gitlab.conclusive.pl/devices/rocky-patching project. Installed on a testing machine created with

CVE=CVE-2022-42896 ./ninja.sh _run_test-ciqlts8_8-CVE-2022-42896

kABI check: omitted

Boot test: passed

boot-test.log

Kselftests: passed relative

Kselftests were split into two parts:

  1. using kernel-rt-selftests-internal package (for ease of use and stability of the tests) and
  2. using kselftests compiled from kernel source (for coverage).

Packaged tests

Tests set covered

  • bpf
  • livepatch
  • net
  • net/forwarding
  • net/mptcp
  • netfilter
  • tc-testing
  • vm

Tests stability analysis on a reference kernel

A series of 7 test runs were conducted on the reference LTS 8.8 RT kernel ciqlts8_8-rt (eca3abc5e9ff4cae5b5d2a54869f2196d281aefe) of which 3 finished without issues.

kselftests–rpm–ciqlts8_8-rt–run-1.log
kselftests–rpm–ciqlts8_8-rt–run-2.log
kselftests–rpm–ciqlts8_8-rt–run-3.log

It was found that

  • Three tests are dysfunctional
    • bpf:test_progs-no_alu32, bpf:test_progs: Sometimes cause the machine to spontaneously reboot, interrupting the tests run.
    • bpf:test_xsk.sh: Sometimes hangs the machine indefinitely.
  • Three tests are "flappy", their results differing depending on the run: net/mptcp:simult_flows.sh, net:gro.sh, net:udpgro_fwd.sh

For the full picture of unit tests stability state refer to the column https://docs.google.com/spreadsheets/d/1tUwJ2rV57cYZXh7momPtraSjZcHDjMYHLeHA3DYWrUU/edit?pli=1&gid=0#gid=0&range=F:F

Patched kernel

A series of 2 test runs were conducted on the patched kernel, with the machine-hanging bpf:test_xsk.sh test omitted.

kselftests–rpm–ciqlts8_8-rt-CVE-2022-42896–run-1.log
kselftests–rpm–ciqlts8_8-rt-CVE-2022-42896–run-2.log

Comparison

With the unstable tests bpf:test_progs-no_alu32, bpf:test_progs, bpf:test_xsk.sh, net/mptcp:simult_flows.sh, net:gro.sh, net:udpgro_fwd.sh omitted all test results are the same in the patched and referential kernels.

Source-compiled tests

Tests set covered

  • breakpoints
  • capabilities
  • cgroup
  • core
  • cpu-hotplug
  • cpufreq
  • drivers/net/bonding
  • drivers/net/team
  • efivarfs
  • exec
  • filesystems
  • firmware
  • fpu
  • ftrace
  • futex
  • intel_pstate
  • ipc
  • kcmp
  • kvm
  • lib
  • livepatch
  • membarrier
  • memory-hotplug
  • mount
  • mqueue
  • net
  • net/forwarding
  • net/mptcp
  • netfilter
  • nsfs
  • proc
  • pstore
  • ptrace
  • rtc
  • sgx
  • sigaltstack
  • size
  • splice
  • static_keys
  • sync
  • sysctl
  • tc-testing
  • tdx
  • timens
  • timers
  • tpm2
  • user
  • vm
  • x86
  • zram

Tests stability analysis on a reference kernel

A series of 2 test runs were conducted on the reference LTS 8.8 RT kernel ciqlts8_8-rt (eca3abc5e9ff4cae5b5d2a54869f2196d281aefe)

kselftests–source–ciqlts8_8-rt–run-1.log
kselftests–source–ciqlts8_8-rt–run-2.log

It was found that three tests are "flappy", their results differing depending on the run:

  • ipc:msgque
  • kvm:hardware_disable_test
  • net:devlink_port_split.py

For the full picture of unit tests stability state refer to the column https://docs.google.com/spreadsheets/d/1tUwJ2rV57cYZXh7momPtraSjZcHDjMYHLeHA3DYWrUU/edit?pli=1&gid=0#gid=0&range=G:G

Patched kernel

A series of 2 test runs were conducted on the patched kernel

kselftests–source–ciqlts8_8-rt-CVE-2022-42896–run-1.log
kselftests–source–ciqlts8_8-rt-CVE-2022-42896–run-2.log

Comparison

With the tests found to be indeterministic in the stability analysis omitted the test results for the patched kernel were the same as for the reference kernel, except for the kvm:vmx_preemption_timer_test test.

Additional kvm test runs on the patched kernel resulted in kvm:vmx_preemption_timer_test again passing, indicating that this test is also unstable

kselftests–source–ciqlts8_8-rt-CVE-2022-42896–run-kvm.log

Additional tests: none

Following the guidelines from the precedent #41.

Footnotes

1 GHSA-pf87-6c9q-jvm4

@pvts-mat pvts-mat force-pushed the ciqlts8_8-rt-CVE-2022-42896 branch from f782661 to 7fdf696 Compare January 22, 2025 23:24
jira VULN-207
cve CVE-2022-42896
commit-author Luiz Augusto von Dentz <[email protected]>
commit f937b75

l2cap_global_chan_by_psm shall not return fixed channels as they are not
meant to be connected by (S)PSM.

	Signed-off-by: Luiz Augusto von Dentz <[email protected]>
	Reviewed-by: Tedd Ho-Jeong An <[email protected]>
(cherry picked from commit f937b75)
	Signed-off-by: Marcin Wcisło <[email protected]>
@pvts-mat pvts-mat force-pushed the ciqlts8_8-rt-CVE-2022-42896 branch from 7fdf696 to 0a9abf0 Compare January 27, 2025 16:26
Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

Copy link

@gvrose8192 gvrose8192 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - Thanks

@PlaidCat PlaidCat merged commit 80dd39a into ctrliq:ciqlts8_8-rt Jan 27, 2025
1 check passed
github-actions bot pushed a commit that referenced this pull request May 31, 2025
w/ below testcase, it will cause inconsistence in between SIT and SSA.

create_null_blk 512 2 1024 1024
mkfs.f2fs -m /dev/nullb0
mount /dev/nullb0 /mnt/f2fs/
touch /mnt/f2fs/file
f2fs_io pinfile set /mnt/f2fs/file
fallocate -l 4GiB /mnt/f2fs/file

F2FS-fs (nullb0): Inconsistent segment (0) type [1, 0] in SSA and SIT
CPU: 5 UID: 0 PID: 2398 Comm: fallocate Tainted: G           O       6.13.0-rc1 #84
Tainted: [O]=OOT_MODULE
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
Call Trace:
 <TASK>
 dump_stack_lvl+0xb3/0xd0
 dump_stack+0x14/0x20
 f2fs_handle_critical_error+0x18c/0x220 [f2fs]
 f2fs_stop_checkpoint+0x38/0x50 [f2fs]
 do_garbage_collect+0x674/0x6e0 [f2fs]
 f2fs_gc_range+0x12b/0x230 [f2fs]
 f2fs_allocate_pinning_section+0x5c/0x150 [f2fs]
 f2fs_expand_inode_data+0x1cc/0x3c0 [f2fs]
 f2fs_fallocate+0x3c3/0x410 [f2fs]
 vfs_fallocate+0x15f/0x4b0
 __x64_sys_fallocate+0x4a/0x80
 x64_sys_call+0x15e8/0x1b80
 do_syscall_64+0x68/0x130
 entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7f9dba5197ca
F2FS-fs (nullb0): Stopped filesystem due to reason: 4

The reason is f2fs_gc_range() may try to migrate block in curseg, however,
its SSA block is not uptodate due to the last summary block data is still
in cache of curseg.

In this patch, we add a condition in f2fs_gc_range() to check whether
section is opened or not, and skip block migration for opened section.

Fixes: 9703d69 ("f2fs: support file pinning for zoned devices")
Reviewed-by: Daeho Jeong <[email protected]>
Cc: Daeho Jeong <[email protected]>
Signed-off-by: Chao Yu <[email protected]>
Signed-off-by: Jaegeuk Kim <[email protected]>
github-actions bot pushed a commit that referenced this pull request Jun 20, 2025
[ Upstream commit 773704c ]

w/ below testcase, it will cause inconsistence in between SIT and SSA.

create_null_blk 512 2 1024 1024
mkfs.f2fs -m /dev/nullb0
mount /dev/nullb0 /mnt/f2fs/
touch /mnt/f2fs/file
f2fs_io pinfile set /mnt/f2fs/file
fallocate -l 4GiB /mnt/f2fs/file

F2FS-fs (nullb0): Inconsistent segment (0) type [1, 0] in SSA and SIT
CPU: 5 UID: 0 PID: 2398 Comm: fallocate Tainted: G           O       6.13.0-rc1 #84
Tainted: [O]=OOT_MODULE
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
Call Trace:
 <TASK>
 dump_stack_lvl+0xb3/0xd0
 dump_stack+0x14/0x20
 f2fs_handle_critical_error+0x18c/0x220 [f2fs]
 f2fs_stop_checkpoint+0x38/0x50 [f2fs]
 do_garbage_collect+0x674/0x6e0 [f2fs]
 f2fs_gc_range+0x12b/0x230 [f2fs]
 f2fs_allocate_pinning_section+0x5c/0x150 [f2fs]
 f2fs_expand_inode_data+0x1cc/0x3c0 [f2fs]
 f2fs_fallocate+0x3c3/0x410 [f2fs]
 vfs_fallocate+0x15f/0x4b0
 __x64_sys_fallocate+0x4a/0x80
 x64_sys_call+0x15e8/0x1b80
 do_syscall_64+0x68/0x130
 entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7f9dba5197ca
F2FS-fs (nullb0): Stopped filesystem due to reason: 4

The reason is f2fs_gc_range() may try to migrate block in curseg, however,
its SSA block is not uptodate due to the last summary block data is still
in cache of curseg.

In this patch, we add a condition in f2fs_gc_range() to check whether
section is opened or not, and skip block migration for opened section.

Fixes: 9703d69 ("f2fs: support file pinning for zoned devices")
Reviewed-by: Daeho Jeong <[email protected]>
Cc: Daeho Jeong <[email protected]>
Signed-off-by: Chao Yu <[email protected]>
Signed-off-by: Jaegeuk Kim <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
github-actions bot pushed a commit that referenced this pull request Aug 5, 2025
=============================
[ BUG: Invalid wait context ]
6.13.0-rc1 #84 Tainted: G           O
-----------------------------
cat/56160 is trying to lock:
ffff888105c86648 (&cprc->stat_lock){+.+.}-{3:3}, at: update_general_status+0x32a/0x8c0 [f2fs]
other info that might help us debug this:
context-{5:5}
2 locks held by cat/56160:
 #0: ffff88810a002a98 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0x56/0x4c0
 #1: ffffffffa0462638 (f2fs_stat_lock){....}-{2:2}, at: stat_show+0x29/0x1020 [f2fs]
stack backtrace:
CPU: 0 UID: 0 PID: 56160 Comm: cat Tainted: G           O       6.13.0-rc1 #84
Tainted: [O]=OOT_MODULE
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
Call Trace:
 <TASK>
 dump_stack_lvl+0x88/0xd0
 dump_stack+0x14/0x20
 __lock_acquire+0x8d4/0xbb0
 lock_acquire+0xd6/0x300
 _raw_spin_lock+0x38/0x50
 update_general_status+0x32a/0x8c0 [f2fs]
 stat_show+0x50/0x1020 [f2fs]
 seq_read_iter+0x116/0x4c0
 seq_read+0xfa/0x130
 full_proxy_read+0x66/0x90
 vfs_read+0xc4/0x350
 ksys_read+0x74/0xf0
 __x64_sys_read+0x1d/0x20
 x64_sys_call+0x17d9/0x1b80
 do_syscall_64+0x68/0x130
 entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7f2ca53147e2

- seq_read
 - stat_show
  - raw_spin_lock_irqsave(&f2fs_stat_lock, flags)
  : f2fs_stat_lock is raw_spinlock_t type variable
  - update_general_status
   - spin_lock(&sbi->cprc_info.stat_lock);
   : stat_lock is spinlock_t type variable

The root cause is the lock order is incorrect [1], we should not acquire
spinlock_t lock after raw_spinlock_t lock, as if CONFIG_PREEMPT_LOCK is
on, spinlock_t is implemented based on rtmutex, which can sleep after
holding the lock.

To fix this issue, let's use change f2fs_stat_lock lock type from
raw_spinlock_t to spinlock_t, it's safe due to:
- we don't need to use raw version of spinlock as the path is not
performance sensitive.
- we don't need to use irqsave version of spinlock as it won't be
used in irq context.

Quoted from [1]:

"Extend lockdep to validate lock wait-type context.

The current wait-types are:

	LD_WAIT_FREE,		/* wait free, rcu etc.. */
	LD_WAIT_SPIN,		/* spin loops, raw_spinlock_t etc.. */
	LD_WAIT_CONFIG,		/* CONFIG_PREEMPT_LOCK, spinlock_t etc.. */
	LD_WAIT_SLEEP,		/* sleeping locks, mutex_t etc.. */

Where lockdep validates that the current lock (the one being acquired)
fits in the current wait-context (as generated by the held stack).

This ensures that there is no attempt to acquire mutexes while holding
spinlocks, to acquire spinlocks while holding raw_spinlocks and so on. In
other words, its a more fancy might_sleep()."

[1] https://lore.kernel.org/all/[email protected]

Fixes: 98237fc ("f2fs: use spin_lock to avoid hang")
Signed-off-by: Chao Yu <[email protected]>
Signed-off-by: Jaegeuk Kim <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

4 participants